Admin can create, edit, or delete a role

User Story

An administrator may create, edit, or delete a role via the roles and permissions section of the administration menu. See below user stories for specific types of roles that may be created and edited in CollectionSpace 1.0.

Notes

UI -> Service mapping

Access -> Read

Write -> Create, Read, Update

Delete -> Delete

Read Only -> Read, No Update, No Delete

Note: For Read-Only permissions, the App layer would have to render pages only after checking if the user also has Update and/or Delete permissions at the service layer. ReadOnly permission enforcement would require the following 3 permission enforcements in the App layer:

• Check if READ is allowed but also ...

• make sure UPDATE is not allowed AND

• make sure DELETE is not allowed

Dan has mentioned in the earlier STIM on this topic that, the app layer would perform its own access control check. Sanjay’s interpretation: when it comes to controlling the access on UI-owned resources such as pages, widgets, etc., the App layer would enforce additional access control.

Related User Stories:

• Admin can create a new role allowing no access, read, write, and delete at the record level
• Admin can create a new role allowing read or write at the field level
• Admin can edit an existing role
• Admin can delete a role

Derived Stories: